PDF malware analysis — malicious · 253b57b82d90ce15

MALICIOUS

PDF

44.8 KB Created: 2021-05-14 23:47:04 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 96c56e6f185b680c782585334c08922b SHA-1: 51cb88e43778163677efb675cc62b8f2aecce997 SHA-256: 253b57b82d90ce15a9371d302dc5e2fa47a56718a0f09a906039ac0c21172f21

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains a fake CAPTCHA lure and a call-to-action button, directing users to malicious URLs. The ML classifier also flagged this PDF as malicious. The embedded URLs suggest a phishing or scam attempt related to game hacks or free currency.

Machine Learning

Nyx PDF Classifier malicious score 0.9632

Heuristics 4

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/roblox-free-login-game-hack
- https://photographygroupofbunbury.com/images/roblox-hack-codes_GM431946152.pdf
- https://photographygroupofbunbury.com/images/free-robux-hack-2021_GM431946152.pdf
- https://photographygroupofbunbury.com/images/coin-master-free-link-facebook_GM406889139.pdf
- https://photographygroupofbunbury.com/images/free-robux-without-verification-or-survey_GM431946152.pdf
- https://photographygroupofbunbury.com/images/how-to-get-free-robux-in-2021_GM431946152.pdf
- https://photographygroupofbunbury.com/images/how-to-hack-to-get-robux_GM431946152.pdf
- https://photographygroupofbunbury.com/images/how-to-get-free-robux-hack_GM431946152.pdf
- https://photographygroupofbunbury.com/images/free-robux-link_GM431946152.pdf
- https://photographygroupofbunbury.com/images/free-robux-offers_GM431946152.pdf
- https://photographygroupofbunbury.com/images/roblox-hack-me-robux_GM431946152.pdf
- https://photographygroupofbunbury.com/images/when-was-minecraft-free_GM479516143.pdf
- https://photographygroupofbunbury.com/images/free-minecraft-skins-java_GM479516143.pdf
- https://photographygroupofbunbury.com/images/easy-points-gg_GM431946152.pdf
- https://photographygroupofbunbury.com/images/lots-of-robux_GM431946152.pdf
- https://photographygroupofbunbury.com/images/coin-master-server-hack_GM406889139.pdf
- https://photographygroupofbunbury.com/images/how-to-hack-someone-on-roblox_GM431946152.pdf
- https://photographygroupofbunbury.com/images/hacks-minecraft_GM479516143.pdf
- https://photographygroupofbunbury.com/images/coin-master-hacker-club_GM406889139.pdf
- https://photographygroupofbunbury.com/images/coin-master-hack-version-download-ios_GM406889139.pdf
- https://photographygroupofbunbury.com/images/wwwcoin-master-hack-game-download_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000045f7.bin` `b17687fc4e3bf4b0559398a8dd30c33373c5aca261f75e545db1267313a0e5b5`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x45F7	24888 bytes
`font_01_sfnt_off00007f36.bin` `43e72e756231cfd354bd65c2ed3b09ad4eff56ad11e7f155ed2920e6bb7860dd`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7F36	3992 bytes
`font_02_sfnt_off00008c5d.bin` `a8d26950e0e2eef33b27b6c10906646661cb910c2bf8a097fd7ed42515788ae2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8C5D	18356 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.